
Product
Announcing Socket Fix 2.0
Socket Fix 2.0 brings targeted CVE remediation, smarter upgrade planning, and broader ecosystem support to help developers get to zero alerts.
@janus-idp/backend-plugin-manager
Advanced tools
Backstage plugin management backend
This package adds experimental support for dynamic backend plugins, according to the content of the proposal in RFC 18390
This package is EXPERIMENTAL, and is subject to change according to the discussions and conclusions that happen around the RFC mentioned above.
In order to test the dynamic backend plugins feature provided by this package, example applications, as well as example dynamic plugins have been provided in provided in the showcase repository, and instructions are provided in the related Readme.
The backend plugin manager is a service that scans a configured root directory (dynamicPlugins.rootDirectory in the app config) for dynamic plugin packages, and loads them dynamically.
In the backend-next application, it can be enabled by adding the backend-plugin-manager as a dependency in the package.json and the following lines in the src/index.ts file:
const backend = createBackend();
+
+ backend.add(dynamicPluginsFeatureDiscoveryServiceFactory()) // overridden version of the FeatureDiscoveryService which provides features loaded by dynamic plugins
+ backend.add(dynamicPluginsServiceFactory())
+
Due to some limitations of the current backstage codebase, the plugins need to be completed and repackaged to by used as dynamic plugins:
dynamicPluginInstaller) of a specific type (BackendDynamicPluginInstaller), as can be found in the src/dynamic sub-folder of each dynamic plugin example provided in the showcase repository.package.json file in which dependencies are updated to share @backstage dependencies with the main application.Points 2 and 3 can be done by the export-dynamic-plugin CLI command used to perform the repackaging
export-dynamic-plugin commandThe export-dynamic-plugin CLI command, used the dynamic plugin examples provided in the showcase repository, is part of a @backstage/cli fork (@dfatwork-pkgs/backstage-cli@0.22.9-next.6), and can be used to help packaging the dynamic plugins according to the constraints mentioned above, in order to allow straightforward testing of the dynamic plugins feature.
However the backend-plugin-manager experimental package does not depend on the use of this additional CLI command, and in future steps of this backend dynamic plugin work, the use of such a dedicated command might not even be necessary.
The backend dynamic plugins feature clearly targets the new backend system. However some level of compatibility is provided with current backstage codebase, which still uses the legacy backend system, in order to allow testing and exploring dynamic backend plugin support on the widest range of contexts and installations. However, this is temporary and will be removed once the next backend is ready to be used and has completely replaced the old one. This is why the API related to the old backend is already marked as deprecated.
The current implementation of the backend plugin manager is a first step towards the final implementation of the dynamic backend plugins feature, which will be completed / simplified in future steps, as the status of the backstage codebase allows it.
FAQs
Backstage plugin management backend
We found that @janus-idp/backend-plugin-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Fix 2.0 brings targeted CVE remediation, smarter upgrade planning, and broader ecosystem support to help developers get to zero alerts.

Security News
Socket CEO Feross Aboukhadijeh joins Risky Business Weekly to unpack recent npm phishing attacks, their limited impact, and the risks if attackers get smarter.

Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.